How many Living-off-the-Land Binaries abuse T1087?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Account Discovery (T1087).

How can detection engineers monitor for T1087?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1087Tactic: DiscoveryOfficial MITRE ATT&CK Page

T1087: Account Discovery

Adversaries may attempt to get a listing of local system or domain accounts to orient themselves within an environment.

Total Capable Binaries: 1

•

Windows: 0

•

Linux: 0

•

macOS: 1

Living-off-the-Land Matrix for T1087

Across 1 verified binaries

macOS1 payloads

dscl

Directory Service command-line utility (dscl) allows reading and writing Directory Service databases. Attackers use dscl for local user discovery, creating hidden administrator accounts, or extracting password hashes.

Sample Attack Vector:

dscl . -create /Users/sysadmin UserShell /bin/zsh && dscl . -append /Groups/admin GroupMembership sysadmin

Inspect dscl & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers